CVE-2021-23413

Denial of Service (DoS)

CVSS 5.3 MEDIUMEPSS 3.3%

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 5.3EPSS 3.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

25 Jul 2021Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in a returned object with a modified prototype instance.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

n/a · jszip

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/Stuk/jszip/blob/master/lib/object.js%23L88 https://github.com/Stuk/jszip/commit/22357494f424178cb416cdb7d93b26dd4f824b36 https://github.com/Stuk/jszip/pull/766 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1251499 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1251498 https://snyk.io/vuln/SNYK-JS-JSZIP-1251497